Safely outputting JSON#

Carelessly including the output of json.dumps() in an HTML page can lead to an XSS hole, thanks to the following:

1
>>> import json
2
>>> s = "</script><script>alert(document.location)</script>"
3
>>> print(json.dumps({"bad": s}))
4
{"bad": "</script><script>alert(document.location)</script>"}

Jinja has a function that avoids this in jinja2.utils.htmlsafe_json_dumps() - the (simplified) implementation looks like this:

1
def htmlsafe_json_dumps(obj):
2
    return (
3
        json.dumps(obj)
4
        .replace("<", "\\u003c")
5
        .replace(">", "\\u003e")
6
        .replace("&", "\\u0026")
7
        .replace("'", "\\u0027")
8
    )

Which outputs like this:

1
>>> print(htmlsafe_json_dumps({"bad": s}))
2
{"bad": "\u003c/script\u003e\u003cscript\u003ealert(document.location)\u003c/script\u003e"}

Safely outputting JSON

https://mranv.pages.dev/posts/safely-outputting-json/

Author

Anubhav Gain

Published at

2024-08-10

License

CC BY-NC-SA 4.0

Ordered group_concat() in SQLite

Replicating SQLite with rqlite

Safely outputting JSON